\n<\/p>\n
Offering a rare glimpse at the priorities of a top spy organization, Canada\u2019s Communications Security Establishment said it conducted a handful of state-authorized hacks last year in order to disrupt the operations of drug traffickers, violent extremists, and a ransomware gang.<\/p>\n
The disclosures in the Canadian intelligence agency\u2019s annual report<\/a> underscore some of the main national security threats that face Canada and its closest allies: ranging from the import of illegal drugs to cyberattacks. The spy agency, CSE, is tasked with collecting foreign intelligence, defending government systems, and disrupting online adversaries.<\/p>\n Published last week, the report says the CSE last year carried out three foreign \u201cactive cyber operations\u201d \u2014 the term agency uses to describe its cyberattacks on overseas operations that threaten Canadian national security and public safety.<\/p>\n One of the operations, per the report, targeted cybercriminals outside of Canada who were brokering the sale of chemicals used to create the synthetic opioid, fentanyl. The CSE collected intelligence on the brokers, then conducted an operation that \u201cdisrupted and diminished their ability to operate,\u201d the report said.<\/p>\n Another active operation involved the collection of signals intelligence \u2014 data produced from electronics and internet-connected devices \u2014 on an overseas extremist group that was spreading violent ideology and recruiting members, including in Canada. <\/p>\n The report said the agency analyzed the group\u2019s organization, reach, and potential vulnerabilities to conduct an operation that \u201csuccessfully undermined the group\u2019s credibility and limited their ability to radicalize and recruit new members.\u201d<\/p>\n Another operation involved disrupting a ransomware-as-a-service operation that let hackers rent access to a ransomware gang\u2019s infrastructure to launch destructive extortion attacks. The CSE said its signals intelligence unit identified how the gang worked against the healthcare, transportation, and business sectors in Canada, then used an active cyber operation that \u201crendered the group\u2019s infrastructure inoperable.\u201d The operation also deleted much of the data on the gang\u2019s servers.<\/p>\n The agency said it undertook concurrent \u201ctechnical disruptions\u201d against 10 of the most significant ransomware gangs targeting Canada to \u201cmake parts of their infrastructure unusable.\u201d<\/p>\n The report did not say where the hackers, extremists or the ransomware gang were located, or the specifics of the operations that the CSE used to target them. It\u2019s not uncommon for spy agencies to conduct cyberattacks against their adversaries, but such operations are seldom disclosed or detailed to protect the methods and techniques used.<\/p>\n Fort Meade, Maryland-based Cyber Command, which conducts cyber operations for the U.S. government, regularly carries out \u201chunt forward\u201d operations that involve sending cyber teams to allied nations to secure their networks and disrupt cyber operations launched by adversaries. The number of U.S.-led hunt forward operations have risen from a few handful during 2018 to more than two dozen during 2025<\/a>.<\/p>\n Canada\u2019s CSE said it also carried out one defensive cyber operation during the year to target a phishing campaign aimed at Canadian federal government institutions and other important systems. The agency said it disrupted the group\u2019s infrastructure and \u201cdegraded their ability\u201d to target Canadians.<\/p>\n<\/div>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\n